Vulncheck

**Name of the Vulnerable Software and Affected Versions** AMMOS Instrument Toolkit (AIT) GUI versions prior to 2.5.1 **Description** An authentication flaw allows an unauthenticated network attacker to obtain a valid session and issue arbitrary spacecraft commands. This is possible by calling the `Sessions.create()` function, which fails to perform credential checks. Once a session is established, an attacker can invoke the `handle cmd()` function to forward arbitrary commands directly to the AIT command bus, as there is no authentication gate between session creation and command dispatch. **Recommendations** Update AMMOS Instrument Toolkit (AIT) GUI to version 2.5.1 or later. As a temporary mitigation, restrict network access to the `Sessions.create()` and `handle cmd()` functions.

Care Everywhere Gateway 14.3.10 contains a hard-coded credentials vulnerability in the bundled WildFly 8.2.0.Final management interface that allows unauthenticated remote attackers to gain administrative access by using default credentials identical across all installations. Attackers can authenticate to the exposed WildFly management console on port 20990 and deploy a malicious Web Application Archive file through the Deployments interface to achieve remote code execution as the Windows machine account. Version 14.x.x was declared end-of-life (EOL) in 2017 and future releases have addressed the vulnerable finding.

**Name of the Vulnerable Software and Affected Versions** AMMOS Instrument Toolkit (AIT) Deep Space Network (DSN) Interface versions prior to 2.2.2 **Description** The Space Link Extension (SLE) interface manager lacks proper authentication, allowing unauthenticated network attackers to access seven unprotected API routes via direct HTTP requests. This allows attackers to start or stop Deep Space Network communication sessions, retrieve telemetry frame data, and inject arbitrary frames into active spacecraft links. **Recommendations** Update AMMOS Instrument Toolkit (AIT) Deep Space Network (DSN) Interface to version 2.2.2 or later.

**Name of the Vulnerable Software and Affected Versions** SuperPlane versions prior to 0.30.0 **Description** An SMTP header injection issue exists where unauthenticated attackers can inject arbitrary SMTP headers by including CRLF (Carriage Return Line Feed) sequences in the event payload title field delivered via webhook. By manipulating the unsanitized title field passed to the SMTP DATA command, attackers can add Bcc recipients for content exfiltration, forge the From address to bypass SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) checks, or inject Content-Type and MIME boundary headers to corrupt message bodies for phishing purposes. **Recommendations** Update SuperPlane to version 0.30.0 or later.

**Name of the Vulnerable Software and Affected Versions** SuperPlane versions prior to 0.27.0 **Description** An issue exists in the `CanvasService` gRPC handlers where broken object-level authorization allows authenticated users with viewer-level access in one organization to access resources of other organizations. This occurs when arbitrary canvas or queue UUIDs are supplied without organization scoping. This flaw enables attackers to read cross-tenant execution history and event payloads containing sensitive secrets, write queue items and canvas events into victim organizations, delete arbitrary canvases, and disrupt automation workflows across tenant boundaries. **Recommendations** Update SuperPlane to version 0.27.0 or later.

**Name of the Vulnerable Software and Affected Versions** Apache NimBLE versions prior to 1.10.0 **Description** An incorrect calculation of buffer size occurs when processing Legacy Advertising Report HCI events. When a single HCI advertising report event bundles multiple reports, the software miscalculates the offset to the next report. This can lead the host to read past the end of the buffer and deliver a GAP (Generic Access Profile) event containing bogus data to the application. This issue specifically manifests when the host is paired with a third-party controller that batches multiple reports into one event. **Recommendations** Upgrade to version 1.10.0.

**Name of the Vulnerable Software and Affected Versions** Apache NimBLE versions prior to 1.10.0 **Description** An integer underflow in the Apache NimBLE BASS service occurs due to improper validation when parsing Protocol Data Units (PDU) for the "Add Source" and "Modify Source" operations. This flaw can lead to a stack buffer overflow or an arbitrary out-of-bounds read. The issue can be triggered by nearby devices via a Bluetooth connection, although pairing is required to access the BASS service, which may or may not require user interaction depending on the device configuration. **Recommendations** Upgrade to version 1.10.0.

**Name of the Vulnerable Software and Affected Versions** GFI Archiver versions prior to 15.13 **Description** A stored cross-site scripting issue exists in the Classification Rules configuration. Authenticated attackers can inject arbitrary web script or HTML through the `/Archiver/CategorizationPolicyWizard.aspx` endpoint using the `rule name` and `email criteria` parameters. The payload is stored by the `SaveAllConfigSettings()` function without proper output encoding and is executed in the browsers of users who view the Classification Rules page. **Recommendations** Update GFI Archiver to version 15.13 or later.

**Name of the Vulnerable Software and Affected Versions** GFI Archiver versions prior to 15.13 **Description** A stored cross-site scripting issue exists in the default import settings configuration. Authenticated attackers can inject arbitrary HTML or web scripts through the `configured folders` parameter at the '/Archiver/ImportSettingsWizard.ashx' endpoint. The payload is processed by the `SaveAllConfigSettings()` function without proper output encoding and is subsequently executed in the browsers of users who view the Archive Assistant default import settings. **Recommendations** Update GFI Archiver to version 15.13 or later.

**Name of the Vulnerable Software and Affected Versions** GFI Archiver versions prior to 15.13 **Description** A stored cross-site scripting issue exists in the File Archive Assistant configuration. Authenticated attackers can inject arbitrary HTML or web scripts through the `excluded extensions` parameter at the '/Archiver/FileArchiveAssistantWizard.aspx' endpoint. The payload is processed by the `FileArchiveAssistantWizard.btnSave Click()` function without proper output encoding and is subsequently executed in the browsers of users who access the File Archive Assistant settings page. **Recommendations** Update GFI Archiver to version 15.13 or later. As a temporary mitigation, restrict access to the '/Archiver/FileArchiveAssistantWizard.aspx' endpoint or avoid modifying the `excluded extensions` parameter.

**Name of the Vulnerable Software and Affected Versions** GFI Archiver versions prior to 15.13 **Description** A stored cross-site scripting issue exists in the MailInsights scheduled report configuration. Authenticated attackers can inject arbitrary HTML or web scripts through the report name parameter at the '/Archiver/MailInsights.aspx' endpoint. The payload is processed by the `ReportScheduling.btnSaveReport Click()` function without proper output encoding and is executed in the browser of the user who created the report when they view the MailInsights page. **Recommendations** Update GFI Archiver to version 15.13 or later.

**Name of the Vulnerable Software and Affected Versions** GFI Archiver versions prior to 15.13 **Description** A stored cross-site scripting issue exists in the General Settings SMTP configuration. Authenticated attackers can inject arbitrary HTML or web scripts through the SMTP server address parameter at the '/Archiver/GeneralSettingsWizard.aspx' endpoint. The payload is processed by the `SaveAllConfigSettings()` function without proper output encoding, causing the script to execute in the browsers of users who access the General Settings page. **Recommendations** Update GFI Archiver to version 15.13 or later.

**Name of the Vulnerable Software and Affected Versions** GFI Archiver versions prior to 15.13 **Description** A stored cross-site scripting issue exists in the IMAP Server configuration. Authenticated attackers can inject arbitrary HTML or web scripts through the `server URL` parameter at the '/Archiver/ImapServerWizard.aspx' endpoint. The payload is processed by the `ImapServerWizard.SaveAllConfigSettings()` function without proper output encoding, causing the script to execute in the browsers of users who access the IMAP Server configuration page. **Recommendations** Update GFI Archiver to version 15.13 or later.

**Name of the Vulnerable Software and Affected Versions** GFI Archiver versions prior to 15.13 **Description** A stored cross-site scripting issue exists in the Call Home proxy server configuration. Authenticated attackers can inject arbitrary HTML or web scripts through the proxy server address parameter at the '/Archiver/CallHomeSettingsWizard.aspx' endpoint. The payload is processed by the `SaveAllConfigSettings()` function without proper output encoding and is subsequently executed in the browsers of users who access the General Settings Additional Settings page. **Recommendations** Update GFI Archiver to version 15.13 or later.

**Name of the Vulnerable Software and Affected Versions** gpsd versions prior to 3.27.6 **Description** The `gpsprof` utility contains a code injection flaw. An attacker controlling GPS input data can execute arbitrary OS commands by injecting malicious content into the `SKY.satellites[].used` field. This field is inserted without sanitization into a gnuplot heredoc data block. By supplying a `used` value containing the string EOD, an attacker can terminate the heredoc prematurely and append gnuplot `system()` calls, leading to command execution as the user running `gpsprof` when the script is processed by gnuplot in polar mode. **Recommendations** Update to the version containing commit 4c06658 or later.

**Name of the Vulnerable Software and Affected Versions** GFI Archiver versions prior to 15.13 **Description** A stored cross-site scripting issue exists in the File History Retention Policy configuration. Authenticated attackers can inject arbitrary HTML or web scripts through the policy name parameter at the '/Archiver/FAARetentionPolicyWizard.aspx' endpoint. The payload is processed by the `SaveAllConfigSettings()` function without proper output encoding and is subsequently executed in the browsers of users who access the File History Retention Policies page. **Recommendations** Update GFI Archiver to version 15.13 or later.

**Name of the Vulnerable Software and Affected Versions** GFI Archiver versions prior to 15.13 **Description** A stored cross-site scripting issue exists in the Retention Policy configuration. Authenticated attackers can inject arbitrary HTML or web scripts through the policy name parameter at the '/Archiver/RetentionPolicyWizard.aspx' endpoint. The payload is processed by the `SaveAllConfigSettings()` function without proper output encoding and is subsequently executed in the browsers of users who access the Retention and Spam Policies page. **Recommendations** Update GFI Archiver to version 15.13 or later.

**Name of the Vulnerable Software and Affected Versions** kirby-modules versions prior to 5.5.8 **Description** An information disclosure issue allows any authenticated Kirby Panel user to retrieve the full plaintext commercial license key. This occurs when a GET request is sent to the 'modules/activate' dialog endpoint. The activate dialog handler in `lib/areas.php` uses the `ModulesLicense::readKey()` function to return the key without verifying if the user has administrator privileges. Because the dialog is only restricted by the `access.system` permission, which is enabled by default for all non-admin roles, unauthorized users can obtain the key and use it to activate the plugin on other installations. **Recommendations** Update kirby-modules to version 5.5.8 or later. Restrict the `access.system` permission for non-administrator roles to prevent unauthorized access to system dialogs.

**Name of the Vulnerable Software and Affected Versions** rConfig Core versions prior to 8.2.8 **Description** Authenticated users can escalate privileges by assigning arbitrary roles to any account. This occurs when an unvalidated role field is submitted through the Users API during user creation or profile updates. The issue stems from missing allowlist validation and the absence of admin-level authorization checks in the `StoreUserRequest` function, allowing the Admin role to be mass-assigned directly to the User model. **Recommendations** Update rConfig Core to version 8.2.8 or later. As a temporary mitigation, restrict access to the Users API to prevent unauthorized profile updates or user creation.

**Name of the Vulnerable Software and Affected Versions** Cornac versions prior to 2.6.0 **Description** A path traversal issue, specifically a Tar Slip, exists when the ` extract archive()` function in cornac/utils/download.py processes a crafted TAR archive. By using absolute paths, symlink/hardlink entries, or `../` sequences, an attacker can cause `archive.extractall()` to write arbitrary files outside the intended cache directory to any location on the filesystem accessible to the running process. This can be triggered via built-in dataset loaders that automatically download and extract archives. **Recommendations** Update to version 2.6.0 or later. As a temporary mitigation, restrict the use of the ` extract archive()` function or avoid using built-in dataset loaders with untrusted archives.